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EXAMINER'S ANSWER 



This is in response to the appeal brief filed 07/28/2008 appealing from the Office action 
(Final rejection after filing of an RCE) mailed 04/25/2008. 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

US-6,714,976 B1 03-2004 Wilson etal. 

US-6,473.407 B1 1 0-2002 Ditmer et al. 

US-7,143,153B1 11-2006 Black etal. 
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(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Claims 1, 4 and 6-12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Wilson et al. (U.S. Patent Publication # 6,714,976 B1) in view of Ditmer et al. 
(U.S. Patent Publication # 6,473,407 B1) and further in view of Black et al. (U.S. 
Patent Publication # 7,143,153 B1). 

Consider claim 1, Wilson et al. show and disclose a method of filtering one or 
more events associated with one or more computer environments for display in a 
performance monitoring system, wherein each of the one or more events is generated 
when a threshold associated with a first parameter is met (Fig. 14, flowchart blocks 322 
and 324 that show and disclose a filtering process for collected event data by 
comparing the data with pre-defined rules, then continuing to process the filtered data 
only; column 18, lines 40-42 that disclose how the events related to business 
transactions are processed by the filtering process described in the flowchart; column 6, 
lines 27-45 that describe a second filtering process for monitoring the performance of 
various computer systems in a network by disclosing that users can select and specify 
in the configuration plug-in modules which events to monitor by the monitoring agents; 
Abstract; Fig.1 ; column 4, lines 31-50 that show and disclose the monitoring 
environment with a multiplicity of computer environments (server s1 block 20 and server 
s2 block 22 and monitoring agents 30-40); Fig. 13 and column 17, lines 8-14 that show 
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and disclose the corresponding set up for business transaction monitoring events; Fig. 
7; column 10, lines 39-48; column 14, lines 2-7 that disclose defining the trigger events 
and collecting diagnostic information for performance monitoring of computer 
environments; Fig. 14; column 18, lines 1-8 that show and disclose the corresponding 
details for business transaction monitoring events), the method comprising the steps of: 
receiving a filter a set of the one or more computer environments (Fig. 1 , EM Console 
block 42 that receives event triggered data from EM agents 30-40; column 6, lines 42- 
45 that disclose the plug-in modules for filtering and capturing the event triggered data 
and sending the captured data to the EM Console; Table in Fig. 1 1 that shows the type 
of data collected including system component 268 as one or more computer 
environments; and 

displaying the filtered one or more events (Fig. 1 , EM Console block 42 and Monitoring 
Station 24; column 4, lines 20-30 and 63-67 that show and disclose monitoring and 
managing of a distributed application, with an application program running on console 
42 that displays event-triggered monitored data at the component and at the enterprise 
level). 

However, Wilson et al. do not explicitly disclose that in response to the receiving 
step, filtering the one or more events using the filter, wherein the filter is received from, 
and the one or more filtered events are displayed on a single display window; and 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 
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In the same field of endeavor, Ditmer et al. disclose that in response to the 
receiving step, filtering the one or more events using the filter, wherein the filter is 
received from, and the one or more filtered events are displayed on a single display 
window (column 13, lines 28-39 which disclose a method for alarm management from a 
single workstation, including display or print lists of active alarms and define or display 
customized alarm filters to specify which alarms will appear in the alarm presentation). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to provide, in response to the receiving step, a means 
for filtering the one or more events using the filter, wherein the filter is received from, 
and the one or more filtered events are displayed on, a single display window, as taught 
by Ditmer et al., in the method of Wilson et al., so as to provide the users with specific 
events based on filters defined by the users, thereby displaying focused event 
information in a single workstation window. 

However, Wilson et al., as modified by Ditmer et al., do not specifically disclose 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 

In the same field of endeavor, Black et al. show and disclose displaying a link 
from a first set of information related to the filtered one or more events being displayed, 
said link for accessing a second set of information related to the first set of information 
(Figs. 7A and 7C that show links both in the form of clickable status buttons 899a-899e 
(Fig. 7A) and as links 899a-899e (Fig. 7C); when one of these links is clicked, the GUI 
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of Fig. 7B is displayed, providing additional details of the filtered event; column 37, lines 
19-35 and 48-55 disclose the same details). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to disclose displaying a link from a first set of 
information related to the filtered one or more events being displayed, said link for 
accessing a second set of information related to the first set of information, as taught by 
Black et al. in the method of Wilson et al., as modified by Ditmer et al., so as to provide 
the network administrator additional status information for one or more filtered events, 
whenever the administrator wishes to further monitor an event that may be of critical 
importance by clicking on the link. 

Consider claim 4, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further show and disclose a method wherein for each of 
the filtered one or more events, the displaying step further comprises the step of 
displaying a first set of information associated with an event identifier (Fig. 1 1 , 
Exception ID column 262; column 13, lines 64-66 that disclose an event identifier field 
262); 

the associated one or more computer environments (Fig. 1 1 , Components Type field in 
column 266; column 14, lines 7-10 that describe the data item associated with column 
266 of the table in Fig. 11); 
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the first parameter (Fig. 1 1 , System Components for Data Gathering column 268; 
column 14, lines 16-34 that describe the data item associated with column 268 of the 
table in Fig. 11); 

the second parameter (Fig. 1 1 , Threshold column 264; column 13, lines 66-67 and 
column 14, lines 1-7 that describe the data item associated with column 264 of the table 
in Fig. 11); and 

a second parameter identifier (Fig. 1 1 , Data ID field of column 266; column 14, lines 7- 
1 5 that describe the data item associated with column 266 of the table in Fig. 1 1 ). 

Consider claim 6, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein the second set of 
information comprises information associated with the configuration of the one or more 
computer environments (column 1 5, lines 1 3-1 5 which disclose that the data contained 
in table 260 of Fig. 1 1 (first set of information) is associated with the configuration 
information (second set of information) of the computer system being monitored). 

Consider claim 7, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein the second set of 
information comprises information associated with the threshold (column 13, lines 64-67 
and column 14, lines 1-7 which disclose that the second set of information (column 264 
of Fig. 11) comprises information associated with the threshold). 
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Consider claim 8, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose the claimed invention including 
disclosing that the first parameter represents a severity level (in Ditmer et al. reference, 
column 20, line 46 that discloses different levels of severity for monitoring events). 



Consider claim 9, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method comprising the steps of: 
receiving a second filter representing at least one second parameter (in Ditmer et al. 
reference, Fig. 9, column 20, lines 35-67 and column 21, lines 1-35 which disclose that 
a customer typically subscribes to several services; therefore, in order to limit data 
collection to data germane to those particular services, the user must specify which 
services (e.g. VNET in the SQL statement shown in column 21, lines 9-18) need to be 
monitored, thereby disclosing receiving a second filter representing at least one second 
parameter), 

filtering the one or more events using the second filter in response to receiving the 
second filter (the SQL statement shown in column 21 , lines 9-18, which acts as a filter 
to limit the monitored events only to the services subscribed by the customer), 
wherein the second parameter represents a resource (in Ditmer et al. reference, the 
services subscribed represent monitoring corresponding resources for any events). 
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Consider claim 10, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method further comprising the steps 
of: 

receiving a second filter representing at least one second parameter (in Ditmer et al. 
reference, column 21, lines 52-58 which disclose that events identified in the event view 
(defined by the user) may be periodically forwarded based upon a customer 
configurable interval, thereby disclosing receiving a second filter representing at least 
one second parameter (period or time interval for which the generated events are to be 
displayed in the user view)), 

filtering the one or more events using the second filter in response to receiving the 
second filter (in Ditmer et al. reference, column 21, lines 52-58 which further disclose 
that only the events generated during the specified time interval (second filter) are made 
available in an event queue for display to the user in order of the severity of the event), 
wherein the second parameter represents a time (in Ditmer et al. reference, column 21 , 
lines 52-58 which disclose that events identified in the event view (defined by the user) 
may be periodically forwarded based upon a customer configurable interval, thereby 
disclosing that the second parameter represents a time). 

Consider claim 11, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein each of the one or 
more computer environments comprises at least one computer system (in Wilson et al. 
reference, Fig. 1 , server s1 block 20 and server s2 block 22 as examples of one or more 



Application/Control Number: 10/667,581 Page 1 1 

Art Unit: 2443 

computer environments with at least one computer system; column 4, lines 20-30 that 
disclose various components of the invention). 

Consider claim 12, Wilson et al. clearly disclose an apparatus for filtering one or 
more events associated with one or more computer environments for display in a 
performance monitoring system, wherein each of the one or more events is generated 
when a threshold associated with a first parameter is met (Fig. 14, flowchart blocks 322 
and 324 that show and disclose a filtering process for collected event data by 
comparing the data with pre-defined rules, then continuing to process the filtered data 
only; column 18, lines 40-42 that disclose how the events related to business 
transactions are processed by the filtering process described in the flowchart; column 6, 
lines 27-45 that describe a second filtering process for monitoring the performance of 
various computer systems in a network by disclosing that users can select and specify 
in the configuration plug-in modules which events to monitor by the monitoring agents; 
Abstract; Fig.1; column 4, lines 31-50 that show and disclose a monitoring apparatus 
with a multiplicity of computer environments (server s1 block 20 and server s2 block 22 
and monitoring agents 30-40); Fig. 13 and column 17, lines 1-8 show and disclose the 
corresponding set up for business transaction monitoring events; Fig. 7; column 10, 
lines 39-48; column 14, lines 2-7 that disclose defining the trigger events and collecting 
diagnostic information for performance monitoring of computer environments; Fig. 14; 
column 18, lines 1-8 that show and disclose the corresponding details for business 
transaction monitoring events), the apparatus comprising: 
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means for receiving a filter representing a set of the one or more computer 
environments (Fig. 1 , EM Console block 42 that receives event triggered data from EM 
agents 30-40; column 6, lines 42-45 that disclose the plug-in modules for filtering and 
capturing the event triggered data and sending the captured data to the EM Console; 
Table in Fig. 1 1 that shows the type of data collected including system component 268 
as one or more computer environments); and 

means for displaying the filtered one or more events (Fig. 1 , EM Console block 42 and 
Monitoring Station 24; column 4, lines 20-30 and 63-67 that show and disclose the 
means for monitoring and managing a distributed application, with an application 
program running on console 42 that displays event-triggered monitored data at the 
component and at the enterprise level). 

However, Wilson et al. do not specifically disclose means, responsive to the 
receiving means, for filtering the one or more events using the filter; wherein the filter is 
received from, and the one or more filtered events are displayed on, a single display 
window; and means for displaying a link from a first set of information related to the 
filtered one or more events being displayed, said link for accessing a second set of 
information related to the first set of information. 

In the same field of endeavor, Ditmer et al. disclose means, responsive to the 
receiving means, for filtering the one or more events using the filter, wherein the filter is 
received from, and the one or more filtered events are displayed on, a single display 
window (column 13, lines 28-39 which disclose a means for alarm management from a 
single workstation, including displaying or printing lists of active alarms and defining or 
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displaying customized alarm filters to specify which alarms will appear in the alarm 
presentation). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to provide, means, responsive to the receiving means, 
for filtering the one or more events using the filter, wherein the filter is received from, 
and the one or more filtered events are displayed on a single display window, as taught 
by Ditmer et al., in the apparatus of Wilson et al., so as to provide the users with specific 
events based on filters defined by the users, thereby displaying focused event 
information in a single workstation window. 

However, Wilson et al., as modified by Ditmer et al., do not specifically disclose 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 

In the same field of endeavor, Black et al. show and disclose displaying a link 
from a first set of information related to the filtered one or more events being displayed, 
said link for accessing a second set of information related to the first set of information 
(Figs. 7A and 7C that show links both in the form of clickable status buttons 899a-899e 
(Fig. 7A) and as links 899a-899e (Fig. 7C); when one of these links is clicked, the GUI 
of Fig. 7B is displayed, providing additional details of the filtered event; column 37, lines 
19-35 and 48-55 disclose the same details). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to disclose displaying a link from a first set of 
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information related to the filtered one or more events being displayed, said link for 
accessing a second set of information related to the first set of information, as taught by 
Black et al. in the method of Wilson et al., as modified by Ditmer et al., so as to provide 
the network administrator additional status information for one or more filtered events, 
whenever the administrator wishes to further monitor an event that may be of critical 
importance by clicking on the link. 

(10) Response to Argument 

The examiner's Non-final Office Action for the RCE filed on 09-20-2007 for the 
application 10/667,581 relied on the references listed in section 8 of this Examiner's 
Answer. Claims 1 , 4 and 6-12 were rejected based on the cited references. In 
response, the appellant filed an amendment on 02-04-2008, arguing but without 
amending any claims. 

The examiner sent out the Final Office Action after RCE on 04-25-2008, again 
rejecting claims 1, 4 and 6-12 based on the same cited prior art and responding to the 
arguments. In response, the appellants filed a Notice of Appeal on 07-25-2008 and an 
Appeal Brief on 07-28-2008. 

As stated on page 4 of the appeal brief, the appellants' arguments are limited 
to the independent claim 1 only. The examiner's response to these arguments for 
claim 1 is presented below: 

Consider claim 1 . The appellants on page 5 of the appeal brief argue that the 
cited reference of Wilson et al. (US Patent Publication # 6,714,976 B1) is silent as to 
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"the claimed filter representing a computer environment". The appellants further argue 
(on page 5) that the cited reference does not disclose that "a user actually selects a 
plug-in module", even though the plug-in modules are shown (in Fig. 3) to be present. 
On page 6 of the appeal brief, the appellants state that a teaching (in Wilson et al. 
reference) that event data being filtered comes from different computer environments, 
which is not comparable to a teaching that the filter itself represents a set of one or 
more computer environments. 

The examiner respectfully disagrees with these assertions. The cited paragraph 
in column 6 of the Wilson et al. reference discloses monitoring elements 70 -- 76 within 
an EM (Event Monitoring) agent 50 (shown in Fig. 1 as different EM agents 30-40 and in 
more details in Fig. 2) include code modules that operate on a monitored network node 
for collecting information about certain events. The paragraph further discloses that the 
events may include system events, network events, database events, etc. Such event 
types certainly exist in one or more computer environments, such as enterprise 
computer systems, networks and databases (Sybase, Oracle, etc.). A given example of 
one such event in the enterprise computer environment is a general protection fault (a 
failure event caused by a program instruction that attempts to access forbidden system 
region of the computer memory), which can be defined as a system event. The cited 
paragraph further states that the event detection code may act as plug-in modules that 
a user can select for configuring which events are to be monitored , thereby providing 
the user with options to select from a group of plug-in modules in order to customize 
which events to monitor. Such an option corresponds to a filter for monitoring events in 
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a computer environment, which is what the claim language states. In fact, column 7, 
lines 19-35 disclose that the module 80 (shown in Fig. 3) can filter from the traffic those 
portions that are relevant to the agent 50. In addition, Fig. 5 shows a Tap Filter Device 
162, which is described in column 8, lines 19-44. 

The appellants' assertion that the teaching in the Wilson et al. reference that 
event data being filtered comes from different computer environments is not comparable 
to a teaching that the filter itself represents a set of one or more computer 
environments, lacks credibility, because a filter itself does not represent computer 
environments, it is some computer code that selects a user specified portion of data (or 
events) from a larger set of relevant data. No reason is provided as to why the teaching 
of Wilson et al. is not comparable to the teaching of claim 1 . Event Monitoring elements 
70-76 shown in Fig. 3 include filter code to select either system events (element 70), or 
network events (element 72) or database events (elements 74 and 76), which are three 
different computer environments. 

The appellants continue to argue (on page 6) that for claim 1 , the cited prior art of 
Ditmer et al. (US Patent Publication # 6,473,407 B1) discloses "a single workstation", 
instead of "a single display window" as claimed; further arguing that Ditmer et al. do not 
teach "filtering events (which are associated with one or more computer environments) 
based upon a filter representing a set of the one or more environments", as claimed. 
On page 7, the appellants further allege that the examiner has failed to produce any 
factual evidence that Ditmer teaches this entire claimed limitation. Then, on page 8, the 
appellants argue that since the filters of the Wilson et al. and Ditmer et al. references 
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have different applications, there is no reasonable expectation of success when 
combining the two references to establish a prima facie case of obviousness. 

The examiner begs to differ. The display on a single workstation is quite capable 
of displaying a single window, as happens in the display of a desktop, or any other fully 
expanded window. Furthermore, the Ditmer reference was relied upon to only disclose 
the claim element specifying "a single display window". The filter and the data for the 
computer environments it processes are already disclosed by the Wilson et al. 
reference, even though the Ditmer et al. reference also discloses filtering event data 
such as alarms, which certainly occur in different computer environments. In response 
to appellants' arguments against the references individually, one cannot show non- 
obviousness by attacking references individually where the rejections are based on 
combination of references. In any case, the examiner relied upon the Ditmer et al. 
reference to only disclose the claim element specifying "a single display window". As to 
the appellants' argument that the Wilson and Ditmer references have different 
applications, and therefore should not have been combined, the examiner does not 
agree with such assertion. Filtering alarms in a voice and data network of 
MCI/WorldCom, as disclosed in the Ditmer et al. reference is in the same application 
class as any other event monitoring method in a computer environment. 

On page 9 of the appeal brief, the appellants mischaracterize the inclusion of a 
full claim element instead of a phrase "a single display window", to state that the 
examiner's assertion that "the examiner needed the combination with Ditmer at al. only 
to show 'a single display window' feature of claim" stands in stark contrast to the 
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examiner's assertion in the paragraph spanning pages 4 and 5 of the Second Office 
Action, fully realizing that the remaining features in the included claim element have 
already been disclosed in the Wilson et al. reference. This was clearly stated in the 
"Response to Arguments" section of the final office action after RCE, wherein the 
examiner's response was "The applicants also argue that Ditmer et al. reference does 
not teach filtering events (which are associated with one or more computer 
environments) based upon a filter representing a set of the one or more environments 
as claimed. As explained above, this element of claim 1 is taught by Wilson et al. 
reference. Yet, the Ditmer et al. reference also discloses the filtering of events based 
on alarms, which are raised when certain events cross the specified thresholds". 
Therefore, the examiner respectfully disagrees with appellants above argument, which 
requires no further response. 

There are no other arguments presented that require any response from the 
examiner for any of the remaining claims. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 



For the above reasons, it is believed that the rejections should be sustained. 
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Respectfully submitted, 
IK. G. B.l 

Examiner, Art Unit 2443 
October 3, 2008 

/Nathan J. Flynn/ 

Supervisory Patent Examiner, Art Unit 2454 



confrees: 
/Nathan J. Flynn/ 

Supervisory Patent Examiner, Art Unit 2454 
/John Follansbee/ 

Supervisory Patent Examiner, Art Unit 2151 



